umputun / stash

81%

master: 83%

LAST BUILD ON BRANCH feature/granular-auth

branch: feature/granular-auth

CHANGE BRANCH

x

Reset

• feature/granular-auth
• api-list-keys
• audit-trail
• audit-ui
• ci/add-permissions-blocks
• conflict-detection
• dependabot/cargo/lib/stash-rust/bytes-1.11.1
• dependabot/github_actions/actions/cache-5
• dependabot/github_actions/actions/checkout-6
• dependabot/github_actions/actions/download-artifact-6
• dependabot/github_actions/actions/download-artifact-7
• dependabot/github_actions/actions/setup-go-6
• dependabot/github_actions/actions/setup-java-5
• dependabot/github_actions/actions/setup-node-6
• dependabot/github_actions/actions/setup-python-6
• dependabot/github_actions/actions/upload-artifact-5
• dependabot/github_actions/actions/upload-artifact-6
• dependabot/github_actions/astral-sh/setup-uv-7
• dependabot/github_actions/gradle/actions-5
• dependabot/go_modules/go-modules-35375c2958
• dependabot/go_modules/go-modules-f180a085e8
• docs/claude/fix-ihttp-env-flag
• e2e-playwright-go
• e2e-tests
• feat-public-access
• feat/git-ssh-key
• feat/key-history
• feat/rate-limiting
• feat/selective-session-invalidation
• feat/sighup-auth-reload
• feat/syntax-highlighting
• feat/value-validation
• feature/auth-hot-reload
• feature/cache-layer
• feature/enum-types
• feature/git-versioning
• feature/sdk-sse-subscriptions
• feature/secrets-vault
• feature/subscribe
• feature/web-pagination
• fix-e2e-flaky
• fix/git-concurrency-and-error-handling
• fix/server-code-review-improvements
• java-sdk
• json-schema-validation
• master
• persistent-sessions
• python-sdk
• refactor-audit-package
• refactor-auth
• refactor/consolidate-zk-crypto
• refactor/split-server-subpackages
• refs/tags/v0.1.0
• refs/tags/v0.1.1
• refs/tags/v0.10.0
• refs/tags/v0.10.1
• refs/tags/v0.10.2
• refs/tags/v0.10.3
• refs/tags/v0.10.4
• refs/tags/v0.11.0
• refs/tags/v0.12.0
• refs/tags/v0.12.1
• refs/tags/v0.13.0
• refs/tags/v0.13.1
• refs/tags/v0.13.2
• refs/tags/v0.13.3
• refs/tags/v0.13.4
• refs/tags/v0.14.0
• refs/tags/v0.15.0
• refs/tags/v0.16.0
• refs/tags/v0.17.0
• refs/tags/v0.18.0
• refs/tags/v0.18.1
• refs/tags/v0.19.0
• refs/tags/v0.2.0
• refs/tags/v0.2.1
• refs/tags/v0.2.2
• refs/tags/v0.3.0
• refs/tags/v0.3.1
• refs/tags/v0.4.0
• refs/tags/v0.5.0
• refs/tags/v0.6.0
• refs/tags/v0.7.0
• refs/tags/v0.7.1
• refs/tags/v0.7.2
• refs/tags/v0.7.3
• refs/tags/v0.8.0
• refs/tags/v0.8.1
• refs/tags/v0.8.2
• refs/tags/v0.9.0
• refs/tags/v0.9.1
• refs/tags/v0.9.2
• rust-sdk
• sdk-api
• typescript-sdk
• zk-encryption

Build # 19658592301

Build Type

Pull #8

github

Committed by umputun

Commit Message

feat(auth): add granular authentication with prefix-based ACL

implement comprehensive auth system with YAML-based configuration:
- users with bcrypt passwords for web UI login
- api tokens with bearer auth for programmatic access
- prefix-based permissions (*, app/*, exact match) with longest-match-first
- separate read/write/readwrite access levels per prefix
- session management with httponly/samesite/secure cookies
- __Host- cookie prefix for enhanced https security

security hardening:
- login rate limiting (5 concurrent attempts max)
- constant-time username validation to prevent timing attacks
- acl enforcement on session-based api access (prevents privilege escalation)
- file permission guidance in documentation

includes example auth config file and comprehensive test coverage.

Pull Request Pull Request #8: feat(auth): add granular authentication with prefix-based ACL

Run Details

292 of 302 new or added lines in 4 files covered. (96.69%)

3 existing lines in 1 file now uncovered.

1439 of 1773 relevant lines covered (81.16%)

18.35 hits per line